Overview

overview

10

Static

static

10

Era Setup 1.0.106.exe

windows10-2004-x64

7

Era Setup 1.0.106.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

Era.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

binaries/F...er.exe

windows10-2004-x64

1

binaries/F...er.exe

windows11-21h2-x64

1

binaries/vulcan.exe

windows10-2004-x64

1

binaries/vulcan.exe

windows11-21h2-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...li.exe

windows10-2004-x64

1

resources/...li.exe

windows11-21h2-x64

1

resources/...me.dll

windows10-2004-x64

1

resources/...me.dll

windows11-21h2-x64

1

resources/...er.dll

windows10-2004-x64

1

resources/...er.dll

windows11-21h2-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Era Setup 1.0.106.exe
  • Size 111.9MB
  • Sample250712-gsclpaymz4
  • SHA256 2f8b8a84d3353ad1b0dacd081d1025e3fda262540659b05c852c46caa87430c0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
krustyloaderdiscoveryexecution

Malware Config

Targets

    • Target
      Era Setup 1.0.106.exe
    • Size 111.9MB
    • SHA256 2f8b8a84d3353ad1b0dacd081d1025e3fda262540659b05c852c46caa87430c0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      Era.exe
    • Size 180.2MB
    • SHA256 0e6c9a16f7375ded598e0ff0fe4856c55f9082a6e124ffd7219a9ea8305f303f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral11
    • Target
      LICENSES.chromium.html
    • Size 8.7MB
    • SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral12behavioral13
    • Target
      binaries/FortniteLauncher.exe
    • Size 52KB
    • SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral14behavioral15
    • Target
      binaries/vulcan.exe
    • Size 83.4MB
    • SHA256 2e1bb038a933dd45d99c1db563895e39a97985ad09fc6df473db69025d545320
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16behavioral17
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      ffmpeg.dll
    • Size 2.8MB
    • SHA256 015c30885776c9fe35242bc7ed612c1a3caaf737c4d3116a443e2c473cd87270
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      libEGL.dll
    • Size 481KB
    • SHA256 071160c865fac5bc6c232a10b1906cda0c4315fcf8c5349541cc709e9bcf386c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral20
    • Target
      libGLESv2.dll
    • Size 8.0MB
    • SHA256 c57cf0d74eddd6324a437d3e210949ae39b15c6f058b0828f3cde07c11b6c52c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
    • Size 8.4MB
    • SHA256 afbcd1d671e55c567212f1ded3870fee4d5ca4624fd1016d4f615c8775db48f7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-130/register-scheme.node
    • Size 131KB
    • SHA256 9a458ead35e8b20a70517fbfa9c9442fe4b357f186e5c5ff7f57252c60f5efb5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24behavioral25
    • Target
      resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
    • Size 131KB
    • SHA256 9a458ead35e8b20a70517fbfa9c9442fe4b357f186e5c5ff7f57252c60f5efb5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26behavioral27
    • Target
      resources/app.asar.unpacked/node_modules/register-scheme/index.js
    • Size 91B
    • SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral28behavioral29
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral30behavioral31
    • Target
      vk_swiftshader.dll
    • Size 5.3MB
    • SHA256 9ffb78591fdf2d24f8e7290dc95b98bd16eb59192d9ecec9d656c46164c27e22
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

krustyloader
Score
10/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
7/10

behavioral12

discovery
Score
4/10

behavioral13

discovery
Score
4/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

Score
1/10